OCT. 20. 2006 2:37PM ZILKA-KOTAB, PC 
TO : US PTO 



NO. 4445 P. 



ZilkaKotab 



PC 



SILICA, KOTaB & F IE E C E 



RECEIVED 
CENTRAL FAX CENTER 

OCT 2 0 2006 



100 PARK CENTER PLAZA, SUITE 300 
SAN JOSE, CA 951 13 



TELEPHONE (408) 971-2573 
FAX (408) 971-4660 



FAX COVER SHEET 



1 Date; 


October 20, 2006 


Phone Number 


Fax Number | 


1 To; 


Board of Patent Appeals, USPTO 




(571)273-8300 ] 


From; 


Kevin J. Zilka 







Docket No.; N All P449/0 1.143 .01 App. No: 09/976,009 

Total Number of Pages Being Transmitted, Including Cover Sheet: 38 



Message: 

Please deliver to the Board of Patent Appeals. 




□ Otimal to follow Via Regular MaUX OTisinal will Not be Sent □ Original will follow Via Overnight Courier 



Tbe information contained in this facsimile message is attomey privileged and confidential infbnnation iniended only for tbe use of the individual or 
entity named above If the icsdcr gf this messagp is not the intended recipient, yoo arc Jicreby notified that any dissemination, distribution or copy of 
this eommuzticanon is strictly prohibited. If you have nsceivfsd this eommmiicaiion in error, ploaso inimcdiatcly notiiV ^ ^ telephone (if long 
distance* please c^il I collect) and Tetum the original message to ns ai tbe above address via the U-S- P^tal Service. Thank you. 

IF YOU DO NOT RECEIVE ALL PAGES OR IF YOU ENCOU^JTER 
ANY OTMER DIFFICULTY, PLEASE PHONE Erica 
AT (408) S71-2673 ATYOUR EARUEST CONVQvllENCE 

Oou(b(r2Q, ZOOO 



PAGE 1138 * RCVD AT \ 0/2012006 5:25:49 PM [Eastern Daylight fone] ' SVR:USPTO-EFXRF-2/7 * DNiS:2738300 * CSID:4089714660 ' DURATION i^m%)\m 



OCT. 20. 2006 2:37PM ZILKA-KOTAB, PC NO. 4445 P. 2 

RECEIVED 
CENTRAL FAX CENTER 

OCT 2 0 2006 

Practitioner's Docket No- NAriP449/01,143.01 PATENT 
IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: Neil John Hiirsey et al. 

Application No.: 09/976,009 Group No.: 2136 

Filed: 10/15/2001 Examiner: Colin, Carl G, 

For: UPDATING MALWARE DEFINITION DATA FOR MOBILE DATA PROCESSING DEVICES 

Mail Stop Appeal Briefs -Patents 
Commissioner for Patents 
P.O.Box 1450 

Alexandria, VA 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPtICATION-37 CFJL § 4137) 

1. Transmitted herewith, is the APPEAL BRIEF in this application. This brief is in fiirtherance of the 
Notice of Appeal, filed in this case on 05/23/2006, and the Notice of Panel Decision from Pre-Appeal 
Brief Review, mailed 07/20/06. 

2, STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 
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FEE FOR FILING APPEAL BRIEF 
Pursuant to 37 C.F,R. § 4120(bX2), the fee for filing the Appeal Brief is: 

other than a small entity $500.00 
Appeal Brief fee due $500.00 
EXTENSION OF TERM 

The proceedings herein are for a patent application and die provisions of 37 C.F,R, § 1.136 apply. 

Applicant petitions for an extension of time under 37 CJ,R. § 1.136 (fees: 37 C.F.R. § 
1 . 17(a)(lH5)) for two months: 
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If an additional extension of time is required, please consider this a petition therefor. 
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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re application of: 




2 02006 



Hursey et al. 



Group Art Unit: 2136 



Application No. 09/976,009 



Examiner: Colin, Carl G. 



Filed: 10/15/2001 



Date: 10/20/2006 



For: UPDATING MALWARE 

DEFINfmON DATA FOR MOBILE 
DATA PROCESSING DEVICES 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 



This brief is in furtherance of the Notice of Appeal, filed in this case on 05/23/2006, and the Notice 
of Panel Decision from Pre- Appeal Brief Review, mailed 07/20/06, 

The fees required under §1.17, and any requited petition for extension of time for filing this brief 
and fees therefor, are dealt with in the accompanying TRANSMITTAL OF APPEAL BRIEF, 

This brief contains these items under the following headings, and in the order set forth below (37 
C.F.R. §41.37(c)(i)): 

I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 

III STATUS OF CLAIMS 

IV STATUS OP AMENDMENTS 

V SUMMARY OF CLAIMED SUBJECT MATTER 

VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 
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RECEIVED 

Vn ARGUMENT ^^'^'TRAL FAX CENTER 

vm CLAIMS APPENDIX OCT 2 0 2006 

IX EVIDENCE APPENDIX 

X RELATED PROCEEDING APPENDIX 



The final page of this brief bears the practitioner's signature. 
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RECEIVED 

1 REAL PARTY IN INTEREST (37 C.F.R.§41.37(c)(l)(i)) ^^'^'^ FAX CENTER 

The real party in interest in this a^jpeal is McAfee, Inc. 
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RECEIVED 

n RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 41.37(c) (!)(«)) OCT 2 0 2006 

With respect to other prior or pending appeals, interferences, or related judicial proceedings that 
will directly affect, or be diiectly affected by, or have a bearing on the Board's decision in the 
pending appeal, there are no other such £q)peals, interferences, or related judicial proceedings. 

A Related Proceedings Appendix is appended hereto. 
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m STATUS OF CLAIMS (37 C.F.R. § 41.37(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 
Claims in the appUcation are: 1-3, 5-12, 14-21, 23-30, 32-39, 41-48, and 50-54 

B. STATUS or ALL THE CLAIMS IN APPLICATION 

1 , Claims -withdrawn from consideration: None 

2, Claims pending: 1-3, 5-12, 14-21, 23-30, 32-39. 41-48, and 50-54 

3, Claims allowed: None 

4, Claims rejected: 1-3, 5-12, 14-21, 23-30. 32-39, 41-48, and 50-54 

5, Claims cancelled: 4, 13, 22, 31, 40, and 49 

C. CLAIMS ON APPEAL 

The clauns on appeal are: 1-3. 5-12, 14-21, 23-30, 32-39, 41-48, and 50-54 
See additional status infoimation in the Appendix of Claims. 



RECEIVED 
CENTRAL FAX CENTER 

OCT 2 0 2006 
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IV STATUS OF AMENDMENTS (37 C.F.R. § 41.37(c)(l)Civ)) 

As to flie status of any amendment ffled subsequent to final rejection, there are no such 
amendments aftet final. 
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2 0 2008 



V SUMMARY OF CLAIMED SUBJECT MATTER (37 C,F.R. § 4137(c)(l)(v)) 

With respect to a summary of Claim 1, as shown in Figures 1-4. a computer program product 
embodied on a computer readable medium is provided for controlling a mobile data processing 
device (e.g. see items 2 and 6 of Figure 1, etc.) to update malware definition data for a malwaie 
scanner of the mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.). In use, a 
wireless telephony link is established between the mobile data processing device and a public 
wireless telephony network. Further, malware definition updating data is received at the mobile 
data processing device via a data channel of the wireless telephony link (e.g. see items 36 and 38 
of Figure 3, etc.). In addition, malware definition data (e.g. see item 34 of Figure 2, etc.) stored 
upon the mobile data processing dervice is updated using the malware definition updating data. 
The mobile data processing device registers vvith a base station (e.g. see items 4 and 10 of Figure 
1, etc.) of ^e wireless telephony network when ttie link is established such that the base station 
and the wireless telephony network are notified of a telephone number of the mobile data 
processing device for use in sending the malware definition updating data to the mobile data 
processing device. Also, when data is received at the mobile data processing device, a type of the 
received data is identified (e.g. see item 38 of Figure 3, etc.) to determine if the received data is 
the malware definition updating data. If the received data is the malware defmition updating 
data, a digital signature associated with the malware definition updating data is verified (e.g. see 
item 42 of Figure 3, etc.). If the digital signature is not verified, Ihe malware defmition updating 
data is ignored. Also, if the digital signature is verified, the malware definition updating data is 
utilized to update the malware definition data stored upon the mobile data processing device by 
appending the malware defmition updating data to the malware definition data (e.g. see item 44 
of Figure 3, etc.). The malware defmition updating data is provided in a malware definition 
updating file. The file is generated automatically, semi-automatically, or manually upon an 
analysis of newly discovered malvvare, and the file includes a detection fingerprint and either a 
removal action or a disinfection action to be tsksn in response to a detection of the newly 
discovered malware. In addition, the mobile data processing device is identified by a database of 
subscribers to an update service associated with the malware scanner (e.g. see item 50 of Figure 
4, etc.). The database includes the telephone number of the mobile data processing device to 
which the malwaie defmition updating data is to be sent and a type of the mobile data processing 
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device such that only malware definition updating data that is appropriate to the type of the 
mobile data processing device is sent to the mobile data processing device. See, for example, 
page 3, lines 6-17; page 8, lines 1-1 1; page 8, lines 13-27; page 8, Ime 29 - page 9, line 2; page 
9, lines 4-9; and page 9, lines 14-20 et al. 

With respect to a summary of Claim 10, as shown in Figures 1-4, a computer program product 
embodied on a computer readable medium is provided for controlling a conaputer to initiate 
updating of malware definition data (e.g. see item 34 of Figure 2, etc.) for a malware scanner of a 
mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.). In use, a wireless 
telephony link is established between the mobile data processing device via a public wireless 
telephony network. Further, mal\vare defmition updating data is sent (e.g. see item 50 Figure 4, 
etc.) to said mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.) via a data 
channel of said wireless telephony link. The mobile data processing device registers with a base 
station (e.g. see items 4 and 10 of Figure 1, etc.) of the wireless telephony network when the link 
is established such that the base station and the wireless telephony network are notified of a 
telephone number of the mobile data processing device for use in sending the malware definition 
updating data to the mobile data processing device. Also^ when data is received at the mobile 
data processing device, a type of the received data is identified (e.g. see item 38 of Figure 3, etc.) 
to determine if the received data is the malware definition updating data. If the received data is 
the malware definition updating data, a digital signature associated with the malware definition 
updating data is verified (e.g. see item 42 of Figure 3, etc.). If the digital signature is not 
verified, the malware definition updating data is ignored. Also, if the digital signature is 
verified, the malware definition updating data is utilized to update the malware definition data 
stored upon the mobile data processing device by appending the malware definition updating 
data to the malware definitiot^ data (e.g. see item 44 of Figure 3, etc.). The malware definition 
updating data is provided in a malware definition updating file. The file is generated 
automatically, semi-automatically, or manually upon an analysis of newly discovered malware 
and^ the file includes a detection fingerprint and either a removal action or a disinfection action 
to be taken in response to a detection of the newly discovered malware, In addition, the mobile 
data processing device is identified by a database of subscribers to an update service associated 
with the malware scaimer (e.g. see item 50 of Figure 4, etc). The database includes the 
telephone number of the mobile data processing device to which the malware definition updating 
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data is to be sent and a type of the mobile data processing device such that only malware 
definition updating data that is appropriate to the type of the mobile data processing device is 
sent to the mobile data processing device. See, for example, page 8, lines 1-11; page 8, lines 13- 
27; page 8, line 29 - page 9, line 2; and page 9, lines 4-20; et al. 

With respect to a suamiary of Claim 19, as shown m Figures 1-4, a method is provided for 
updating malware definition data for a malware scanner of a mobile data processing device (e^g. 
see items 2 and 6 of Figure 1, etc.). In use, a wireless telephony link is established between the 
mobile data processing device and a public wireless telephony network. Further, malwaxe 
defmition updating data is received at the mobile data processing device via a data channel of the 
wireless telephony Imk. In addition, malware defmition data (e^g. sec item 34 of Figure 2, etc.) 
stored upon the mobile data processing device is updated using the malware definition updating 
data. The mobile data processing device registers with a base station (e.g. see items 4 and 10 of 
Figure 1, etc.) of the wireless telephony network when the link is established such that the base 
station and the wireless telephony network are notified of a telephone number of the mobile data 
processing device for use in sending the malware definition updating data to the mobile data 
processing device. Also, when data is received at the mobile data processing device, a type of the 
received data is identified (e.g. see item 38 of Figure 3, etc.) to determine if the received data is 
the malware definition updating data. If the received data is the malware definition updating 
data, a digital signature associated with the malware definition updating data is verified (e.g. see 
item 42 of Figure 3, etc.). If the digital signature is not verified, the malware definition updating 
data is ignored. Also, if the digital signature is verified, the malware definition updating data is 
utilized to update the malware definition data stored upon the mobile data processing device by 
appending the malware definition updating data to the malware definition data (e.g. see item 44 
of Figure 3, etc.). The malware definition updating data is provided in a malware definition 
updating file. The file is generated automatically, semi-automatically, or manually upon an 
analysis of newly discovered malware, and the file includes a detection fingerprint and either a 
removal action or a disinfection action to be taken in response to a detection of the newly 
discovered malware. In addition, the mobile data processing device is identified by a database of 
subscribers to an update service associated with the malware scanner (e.g. see item 50 of Figure 
4, etc.). The database includes the telephone number of the mobile data processing device to 
which the malware definition updating data is to be sent and a type of the mobile data processing 
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device such that only malware definition updating data that is appropriate to the type of the 
mobile data processing device is sent to the mobile data processing device. See. for example, 
page 3, Imes 6-17; page 8, lines 1-11; page 8, lines 13-27; page 8, line 29 - page 9, Une 2; page 
9, lines 4-9; and page 9, Imes 14-20 et al. 

With respect to a summary of Claim 28, as shown in Figures 1-4, a method is provided for 
updating malware definition data (e.g. see item 34 of Figure 2, etc.) for a malware scanner of a 
mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.). In use, a wireless 
telephony link is established between the mobile data processing device via a public wireless 
telephony network. Further, malware definition updating data is sent (e.g. see item 50 Figure 4, 
etc.) to said mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.) via a data 
channel of said wheless telephony link. The mobile data processing device registers with a base 
station (e.g. see items 4 and 10 of Figure 1, etc.) of the wireless telephony network when the Imk 
is established such that the base station and the wireless telephony network are notified of a 
telephone number of the mobile data processing device for use in sending the malware definition 
updating data to the mobile data processing device. Also, when data is received at the mobile 
data processing device, a type of the received data is identified (e.g. see item 38 of Figure 3, etc) 
to determine if the received data is the malware defmition updating data. If the received data is 
the malware definition updating data, a digital signature associated with the malware definition 
updating data is verified (e,g. see item 42 of Figure 3, etc.). If the digital signature is not 
verified, the malware definition updating data is ignored. Also, if the digital signature is 
verified, the malware definition updating data is utilized to update the malware definition data 
stored upon the mobile data processmg device by appending the malware defmition updating 
data to the malware definition data (e,g. see item 44 of Figure 3, etc.). The malware defmition 
updating data is provided in a malware definition updating file. The file is generated 
automatically, semi-automatically, or manually upon an analysis of newly discovered malware 
and, the file mcludes a detection iBngerprint and either a removal action or a disinfection action 
to be taken in response to a detection of the newly discovered malware. In addition, the mobile 
data processing device is identified by a database of subscribers to an update service associated 
with the malware scanner (e.g. see item 50 of Figure 4, etc.). The database includes the 
telephone number of the mobile data processing device to which the malware defitution updating 
data is to be sent and a type of the mobile data processing device such that only malware 
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definition updating data that is appropriate to the type of the mobile data processing device is 
sent to the mobile data processing device. See, for example, page 8, lines 1-11; page 8, lines 13- 
27; page 8, line 29 - page 9, line 2; and page 9, lines 4-20; et al. 

With respect to a summary of Claim 37, as shown in Figures 1-4, an apparatus is provided for 
controlling a mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.) to update 
malware definition data for a malware scanner of the mobile data processing device (e.g. see 
items 2 and 6 of Figure 1, etc.). In use, a wireless telephony link is established between the 
mobile data processing device and a public wireless telephony network. Further, malware 
definition updating data is received at the mobile data processing device via a data channel of the 
wireless telephony link. In addition, malware definition data (e,g. see item 34 of Figure 2, etc.) 
stored upon the mobile data processing device is updated using the malware definition updating 
data. The mobile data processing device registers with a base station (e.g. see items 4 and 10 of 
Figure 1, etc.) of the wireless telephony network when the link is established such that the base 
station and the wireless telephony network are notified of a telephone number of the mobile data 
processing device for use in sending the malware defmition updating data to the mobile data 
processing device. Also, when data is received at the mobile data processing device, a type of the 
received data is identified (e.g. see item 38 of Figure 3, etc.) to determine if the received data is 
the malware definition updating data. If the received data is the malware defimtion updating 
data, a digital signature associated with the malware definition updating data is verified (e.g. see 
item 42 of Figure 3, etc.). If the digital signature is not verified, the malware definition updating 
data is ignored. Also, if the digital signature is verified, the malware definition updating data is 
utilized to update the malware defimtion data stored upon the mobile data processing device by 
appending the malware definition updatmg data to the malware defimtion data (e.g. see item 44 
of Figure 3, etc.). The malware defimtion updating data is provided in a malware definition 
updating file. The file is generated automatically, semi-automatically, or manually upon an 
analysis of newly discovered malware, and the file includes a detection fingerprint and either a 
removal action or a disinfection action to be taken in response to a detection of the newly 
discovered malware. In addition, the mobile data processing device is identified by a database of 
subscribers to an update service associated with the malware scanner (e.g. see item 50 of Figure 
4, etc). The database includes the telephone number of the mobile data processing device to 
which the malware defmition updating data is to be sent and a type of the mobile data processing 
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device such that only malware definition updating data that is appropriate to the type of the 
mobile data processing device is sent to the mobile data processing device. See, for example, 
page 3, lines 6-17; page 8, lines 1-11; page 8, lines 13-27; page 8> line 29 - page 9, line 2; page 
9, lines 4-9; and page 9, lines 14-20 et al. 

With respect to a summary of Claim 46, as shown in Figures 1-4, a computer program product 
embodied on a computer readable medium is provided for controlling a computer to initiate 
updating of malware definition data (e.g. see iteiii 34 of Figure 2, etc.) for a malware scanner of a 
mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.). In use, a wireless 
telephony link is established between the mobile data processing device via a public wireless 
telephony network. Further, malware definition updating data is sent (e,g. see item 50 Figure 4, 
etc.) to said mobile data processing device (e.g. see items 2 and 6 of Figure 1, etc.) via a data 
chaimel of said wireless telephony link. The mobile data processing device registers with a base 
station (e.g. see items 4 and 10 of Figure 1, etc.) of the wireless telephony network when the link 
is established such that the base station and the wireless telephony network are notified of a 
telephone number of the mobile data processing device for use in sending the malware definition 
updating data to the mobile data processing device. Also, when data is received at the mobile 
data processing device, a type of the received data is identified (e.g. see item 38 of Figure 3, etc.) 
to determine if the received data is the malware definition updating data. If the received data is 
the malware definition updating data, a digital signature associated with the malware definition 
updating data is verified (e.g. see item 42 of Figure 3, etc.)* If the digital signature is not 
verified, the malware definition updating data is ignored. Also, if the digital signature is 
verified, the malware definition updating data is utilized to update the malware definition data 
stored upon the mobile data processitig device by appending the malware definition updating 
data to the malware definition data (e.g. see item 44 of Figure 3, etc.). The malware definition 
updating data is provided in a malware definition updating file. The file is generated 
automatically, semi-automatically, or manually upon an analysis of newly discovered malware 
and, the file includes a detection fingerprint and either a removal action or a disinfection action 
to be taken in response to a detection of the newly discovered malware. In addition, the mobile 
data processing device is identified by a database of subscribers to an update service associated 
with the malware scanner (e.g. see item 50 of Figure 4, etc.). The database mcludes the 
telephone number of the mobile data processing device to which the malware definition updating 
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data is to be sent and a type of the mobile data processing device such thai only malware 
definition updating data that is appropriate to the type of the mobile data processing device is 
sent to the mobile data processing device, See, for example, page 8, lines 1-11; page 8, lines 13- 
27; page 8, line 29 - page 9, line 2; and page 9, lines 4-20; et al, 
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OCT 2 0 2006 

VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL (37 CJF.R. § 
41.37(c)a)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding ground 
of rejectioa 

Issue # 1: The Examiner has rejected Claims 1-3, 5-12, 14-21, 23-30, 32-39. 41-48 and 50-54 under 
35 U.S.C. 103(a) as bemg unpatentable over Lahti et al, (U.S. Publication No. 2002/0042886) in 
view of Hansson (WO 98/38820). 



PA(£ 19138'RCVD AT 10120/2(1065:25:49 PM [Eastern Daylight Tiine]'SVR:USPTO-EFXra^ 



OCT. 20. 2006 2:41 PM ZILKA-KOTAB, PC 



NO. 4445 P. 20 



-15- 

Vn ARGUMENT (37 CF.R § 41,37(c)(l)(vu)) ^ 

The claims of the groups noted below do not stand or fall together. In the present section, 
appellant explains why the claims of each group are believed to be separately patentable. 

Issue # 1: 

The Examiner has rejected Claims 1--3, 5^12, 14-21, 23-30, 32-39, 41-48 and 50-54 under 35 U.S.C. 
103(a) as being unpatentable over Lahti et al. (U.S. Publication No. 2002/0042886) in view of 
Hansson (WO 98/38820). 

Group #1: Claims 1-3, 5-12, 14-21, 23-30, 32-39, 4M8 and 50-54 

With respect to independent Claims 1 , 10, 19, 28, 37, and 46, the Examiner has relied on 
paragraphs [0019] and [0023] in Lahti along with page 6, lines 1-5 in Hansson to make a prior 
art showing of appellant* s claimed technique *Svfaerein said mobile data processing device 
registers with a base station of said wireless telephony network when said link is established 
such that said base station and said wireless telephony network are notified of a telephone 
number of said mobile data processing device for use in sending said malware definition 
updating data to said mobile data processing device." 

First, appellant respectfully asserts that neither Lahti nor Hansson disclose a "mobile data 
processing device [that] registers with a base station of said wireless telephony network when 
said link is established/' as claimed by appellant (emphasis added). In particular, Lahti only 
generally teaches that "a record of all subscribers to the anti-virus server [is maintained] in a 
database" (paragraph [0023])^ but not that a "mobile data processing device registers with a base 
station. . .when said link is established," as appellant claims. In addition, the entire Hansson 
references and in particular the excerpt in Hansson relied on by the Examiner, fails to even 
suggest any sort of registration, and especially not in the specific manner claimed by appellant. 

Second, appellant notes that the Examiner has relied on Hansson^ s disclosure of an "update 
server processor 100 [that] downloads the software by placing a call to the cellular phone and 
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performing. ..[a] data transfer to the cellular telephone 1 10." Appellant respectfully asserts that 
simply utilizing a phone number to transfer a download does not meet appellant's specific claim 
language, namely that a "mobile data processing device registers with a base station of said 
™less telephony network when said link is established such that said base station and said 
vyireless telepb^i^v network are untified of a t elephone number of said mobile data processing 
device for use in sending said malware definition updating data to said mobile data processing 
device" (emphasis added), in the context claimed. 

In fact, appellant emphasizes that Hansson actually teaches away from registering such that 
notification of a telephone number is made, in the manner claimed by appellant, since Hansson 
discloses that *' f^1 n Response tj> the cellular t elephone subscriber's acceptance of the update , the 
cellular telephone 1 10 transmits a SMS message to the update server processor 100, wherein the 
message contains an acceptance code and the telephone number of the cellular telephone 110" 
(see page 5, lines 1 5-1 8-emphasis added). 

In the Advisory Action mailed 04/11/2006, the Examiner, in response, argued that "Applicant 
concedes that Lahti teaches a register that contains record of all the subscribers to the anti-virus 
service, tiierefore it is inherent or obvious to one of ordinary skill in the art that there is teaching 
and/or suggestion of registration of the subscribers in order for the center to have the records of 
the subscribefs that subscribe to the service." Appellant respectfully disagrees with Ihe 
Examiner's inherency/obviousness argument. Whether or not the above statement by the 
Examiner is correct or not, the Examiner has still not taken into consideration the full weight of 
appellant's claims, SpecificaUy, Lahti only suggests " registered subscribers" (emphasis added). 
Merely maintaining a record of registered subscribers simply does not meet a technique "wherein 
said mobile data processing device r egister s with a base station of said wireless telephony 
network when said Unkis established ..." (emphasis added), as claimed by appellant 

StiU with respect to independent Claims 1, 10, 19, 28, 37, and 46, the Examiner has relied on 
paragraphs [0022]-[00271 in Lahti to make a prior art showing of appellant's claimed technique 
"wherein said malware definition updating data is provided in a malware defmition updating file, 
where said file is generated by one of automatically, semi-automatically, and manually upon an 
analysis of newly discovered malware and where said file includes a detection fingerprint, and at 
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least one of a removal action and a disinfection action to be taken in response to a detection of 
said newly discovered malware/' 

Appellant respectfully asserts that such excerpt from Lahti only discloses an '*SMS 
request,., containing signatures for viruses discovered and analysed since the previous 
update. ..which causes the new signature(s) to be incorporated into the anti-virus database for 
future use." Thus, Lahti teaches that the message only contains the updated virus signatures, and 
not that the *^le includes ... at least one of a removal action and a disinfection action to be taken 
in response to a detection of said newly discovered malware," as claimed by appellant. To 
furdier emphasize such distinction, appellant points out paragraph [0027] in Lahti which states 
that **the user is warned 30 and given the opportunity to delete or clean that file." Clearly, a user 
that must decide whether to delete or clean a file does not suggest that a malware definition 
updating file "includes at least one of a removal action and a disinfection action to be taken in 
response to a detection of said newly discovered malware" (emphasis added), as appellant 
claims. 

In the Advisory mailed 04/1 1/2006, the Examiner, in response, argued thai "[i]n response to 
Applicant's argument that Lahti only discloses messages that contain updates and not files, [the] 
Examiner asserts that Lahti discloses and suggests several ways of obtaining updates...*' 
However, appellant respectfidly asserts that the cited excerpts from Lahti fail to even suggest a 
technique . . where said file includes a detection fingerprint, and at least one of a removal 
action and a disinfection action to be taken in response to a detection of said newlv discovered 
malware" (emphasis added), as claimed, Lahti's teaching that *^e user is warned 30 and given 
the opportunity to delete or clean that file" in no way even suggests that the "definition updating 
file" itself includes "at least one of a removal action and a disinfection action" (emphasis added), 
as claimed by appellant. Only appellant teaches and claims an updating file including such 
specifically claimed action(s). 

Furthemiore, with respect to independent Claims 1, 10, 19, 28, 37, and 46, the Examiner has 
foiled to specifically address appellant's claimed technique "wherein said mobile data processing 
device is identified by a database of subscribers to an update service associated with said 
xnalware scanner, where said database includes said telephone number of said mobile data 
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processing device to whicli said malware defimtion updating data is to be sent airdatype of said 
mnWIe data processing device such that only malware definition updating data that is appropriate 
to said type of said mobile data processing device is sent to said mobile data processing device" 
(emphasis added). 

Appellant notes, however, that in Lahti "an SMS message [is sent] to the server 12 from a device 
1 .containing details of which virus signatures are currently stored in the device's signature 
database" such that "llie anti-virus server 12 needs only to issue an SMS request. . .containing 
virus signatures not currently on the signature database of the mobUe device 1." Thus, Lahti 
only teaches determining appropriate updated signatures ba.sed on signatures akeady located on 
the device, and not that a "database includes a type of said mobile data processing device such 
that only malware definition updating data that is appropriate to said type of said mobile data 
processing device is sent to said mobile data processing device" (emphasis added), as appellant 
claims. 

In Ihe Advisory mailed 04/1 1/2006, the Examiner, in response, argued "[i]n response to 
Applicant's argument that Lahti does not disclose a database that includes a type of mobUe 
device, this limitation is already addressed by [the] Examiner as cited in paragraphs 23-26, the 
server generates a corresponding update upon request from the subscriber." However. Lahti's 
disclosure that "[u]pon receipt of a request, the SMS centre 5 generates a cotresponding SMS 
message and send[s] this to the deiStination mobile device. , ." simply fails to meet a technique 
"where said database includes s^d telephone number of said mobile data processing device to 
which said malware definition updating data is to be sent and a type of said mobile data 
processine device such that only malware definition updating data that is anpronriate to said type 
of said mobile data processing device is sent to said mobile data processmg device" (emphasis 
added), as specificaUy claimed by appellant. There simply is no disclosure in the excerpts from 
Lahti relied upon by the Examiner for a technique where "only malware definition updating data 
that is annropriate to said tvpe of said mobUe data pro cessing device is sent to said mobile data 
processing device" (emphasis added), as claimed by appellant. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
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generally available to one of ordinaxy skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the prior 
art reference (or references when combined) must teach or suggest aU the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. In re 
VaecK9Al F.2d 488, 20 USPQ2d 1438 (FedCirJ99l). 

Appellant respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, since the prior art references, when combined, fail to teach or 
suggest all of the claim limitations, as noted above. 

Thus, all of the independent claims are deemed allowable- Moreover, the remaining dependent 
claims are further deemed allowable, in view of their dependence on such independent claims. 
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Vin CLAIMS APPENDIX (37 C.F.R. § 41.37(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status information) is set 
forth below: 

1 . (Previously Presented) A computer program product embodied on a computer readable 
medium for controlling a mobile data processing device to update maiware definition data for a 
malware scanner of said mobile data processing device, said computer program product 
comprising: 

(i) link establishing code operable to establish a wireless telephony link between said 
mobile data processing device and a public wireless telephony network; 

(ii) update receivmg code operable to receive malware definition updating data at said 
mobile data processing device via a data channel of said wireless telephony link; and 

(ui) malware definition updating code operable to update malware definition data stored 
upon said mobile data processing device using said malware definition updating data; 

wherein said mobUe data processing device registers with a base station of said wireless 
telephony network when said link is established such that said base station and said wireless 
telephony network are notified of a telephone number of said mobile data processing device for 
use in sending said malware definition updating data to said mobUe data processing device; 

wherein when received data is received at said mobile data processing device, a type of 
said received data is identified to determine if said received data is said malware definition 
updating data, such that if said recdved data is said malware definition updating data, a digital 
signature associated with said malware definition updating data is verified; 

wherein if said digital signature is not verified, said malware definition updating data is 
ignored; 

wherein if said digital signature is verified, said malware definition updating data is 
utilized to update said malware definition data stored upon said mobile data processing device by 
appending said malware definition updating data to said malware definition data; 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated by one of automatically, semi-automatically, and 
manually upon an analysis of newly discovered malware and where said file includes a detection 
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fingerprint, and at least one of a removal action and a disinfection action to be taken in response 
to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified by a database of subscribers to 
an update service associated with said malware scanner, where said database includes said 
telephone number of said mobile data processing device to which said malware definition 
updating data is to be sent and a type of said mobile data processing device such that only 
malware definition updating data that is appropriate to said type of said mobile data processing 
device is sent to said mobile data processing device. 

2. (Original) A computer program product as claimed in claim 1, wherein said mobile data 
processing device is a mobile telephone. 

3. (Original) A computer program product as claimed in claim 1 , wherein said mobile data 
processing device is a personal digital assistant having a connection to said wireless public 
telephony network. 

4. (Cancelled) 

5. (Original) A computer program product as claimed in claim 1 , wherein said public 
wireless telephone network is one of a CDMA network and a GSM network. 

6. (Original) A computer propam product as claimed in claim 1, wherein said data channel 
is also used for passing text messages. 

7. (Original) A computer program product as claimed in claim 6, wherein said text 
messages are SMS messages, 

8. (Previously Presented) A computer program product as claimed in claim 1, wherein said 
step of receiving malware defmition updating data is initiated from a source of said malware 
definition updating data. 

9. (Original) A computer program product as claimed in claim 1 , wherein said data channel 
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is open whenever said mobile data processing device is switched on and connected to said public 
wireless telephony network. 

lOt (Previously Presented) A computer program product embodied on a computer readable 
medium for controlling a computer to initiate updating of malware definition data for a malware 
scanner of a mobile data processing device, said computer program product comprising; 

(i) link establishing code operable to establish a wireless telephony link to said mobile 
data processing device via a public wireless telephony network; and 

(ii) update sending code operable to send malware definition updating data to said mobile 
data processing device via a data channel of said wireless telephony link; 

wherein said mobile data processing device registers with a base station of said wireless 
telephony network when said link is established such that said base station and said wireless 
telephony network are notified of a telephone number of said mobile data processing device for 
use in sending said malware definition updating data to said mobile data processing device; 

wherein when received data is received at said mobile data processing device, a type of 
said received data is identified to determine if said received data is said malware definition 
updating data, such that if said received data is said malware definition updating data, a digital 
signature associated with said malware definition updating data is verified; 

wherein if said digital signature is not verified, said malware definition updating data is 
ignored; 

vAercin if said digital signatxire is verified, said malware definition updating data is 
utilized to update malware defmition data stored upon said mobile data processing device by 
appending said malware defmition updating data to said malware definition dat^ 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated by one of automatically, semi-automatically, and 
manually upon an analysis of newly discovered malware and where said file includes a detection 
fingeiprint, and at least one of a removal action and a disinfection action to be taken in response 
to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified by a database of subscribers to 
an update service associated with said malware scanner, where said database includes said 
telephone niimber of said mobile data processing device to which said malware definition 
updating data is to be sent and a type of said mobile data processing device such that only 
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malware definition updating daia that is appropriate to said type of said mobile data processing 
device is sent to said mobile data processing device. 

1 1 . (Original) A computer program product as claimed in claim 1 0, Avherein said mobile date 
processing device is a mobile telephone. 

12. (Original) A computer program product as claimed in claim 10^ wherein said mobile dal 
processing device is a personal digital assistant having a connection to said wireless public 
telephony network. 

13. (Cancelled) 

14. (Original) A computer program product as claimed in claim 1 0, wherein said public 
wireless telephone network is one of a CDMA network mi a GSM network, 

15. (Original) A computer program product as claimed in claim 10, wherein said data 
channel is also used for passing text messages. 

1 6. (Original) A computer program product as claimed in claim 1 5, wherein said text 
messages are SMS messages. 

1 7. (Original) A computer program product as claimed in claim 1 0, wherein transfer of 
malware defmition updating data is initiated from a source of said malware definition updating 
data. 

1 8. (Origmal) A computer program product as claimed in claim 10, wherein said data 
channel is open whenever said mobile data processing device is switched on and connected to 
said public wireless telephony network. 

1 9. (Previously Presented) A method of updating malware definition data for a malware 
scanner of a mobile data processing device, said method comprising the steps of: 
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(i) establishing a wireless telephony link between said mobile data processing device and 
a public wireless telephony network; 

(ii) receiving malware definition updating data at said mobile data processing device via 
a data channel of said wireless telephony link; and 

(iii) updating malwaie definition data stored upon said mobile data processing device 
using said malware definition updating data; 

wherein said mobile data processing device registers with a base station of said wireless 
telephony network when said link is established such that said base station and said wireless 
telephony network are notified of a telephone number of said mobile data processmg device for 
use in sending said malware definition updating data to said mobile data processing device; 

wherein when received data is received at said mobile data processing device, a type of 
said received data is identified to determine if said received data is said malware definition 
updating data, such that if said received data is said malware definition updating data, a digital 
signature associated with said malware definition updating data is verified; 

wherein if said digital signature is not verified, said malware definition updating data is 
ignored; 

wherein if said digital signature is verified, said malware definition updating data is 
utilized to update said malware definition data stored upon said mobile data processing device by 
appending said malware definition updating data to said malware definition data; 

wherein said malware definition updatiing data is provided in a malware dcfmition 
updating file, where said file is generated by one of automatically, semi-automatically, and 
manually upon an analysis of newly discovered malware and where said file includes a detection 
fingerprint, and at least one of a removal action and a disinfection action to be taken in response 
to a detection of said newly discovered malware; 

wherein said mobUe data processing device is identified by a database of subscribers to 
an update service associated with said malware scanner, where said database includes said 
telephone number of said mobile data processing device to which said malware definition 
updating data is to be sent and a type of said mobile data processing device such that only 
malware definition updating data that is appropriate to said type of said mobile data processing 
device is sent to said mobile data processing device. 

20. (Original) A method as claimed in claim 19, wherem said mobile data processing device 
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is a mobile telephone. 



21 . (Original) A method as claimed in claim 19, wherein said mobile data processing device 
personal digital assistant having a connection to said wireless public telephony network. 



IS a 



22. (Cancelled) 

23. (Original) A method as claimed in claim 19, wherein said pubUc wireless telephone 
network is one of a CDMA network and a GSM network. 

24. (Original) A method as claimed in claim 19, wherein said data channel is also used for 
passing text messages. 

25. (Original) A method as claimed in claim 24, wherein said text messages are SMS 
messages » 

26. (Original) A method as claimed in claim 19, wherein transfer of said malware definition 
updating data is initiated from a somce of said malware definition updating data. 

27. (Origmal) A method as claimed in claim 1 9, wherein said data channel is open whenever 
said mobUe data processing device is switched on and connected to said public wireless 
telephony network. 

28. (Previously Presented) A method of updating malware definition data for a malware 
scanner of a mobile data processing device, said method comprising the steps of: 

(i) establishing a wireless telephony link to said mobile data processing device via a 
public wireless telephony network; and 

(ii) sending malware definition updating data to said mobile data processing device via a 
data channel of said wireless telephony link; 

wherein said mobile data processing device registers with a base station of said wireless 
telephony network when said Imk is established such that said base station and said wireless 
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telephony network are notified of a telephone number of said mobile data processing device for 
use in sending said malware definition updating data to said mobile data processing device; 

wherein when received data is received at said mobile data processing device, a type of 
said received data is identified to determine if said received data is said malware definition 
updating data, such that if said received data is said malware definition updating data, a digital 
signature associated with said malware definition updating data is verified; 

wherein if said digital signature is not verified, said malware defmition updating data is 
ignored; 

wherein if said digital signature is verified, said malware definition updating data is 
utilized to update malware defmition data stored upon said mobile data processing device by 
appending said malware definition updatmg data to said malware definition data; 

wherein said malware defmition updating data is provided m a malware definition 
updating file, where said file is generated by one of automatically, semi-automatically, and 
manually upon an analysis of newly discovered malware and where said file includes a detection 
fingerprint, and at least one of a removal action and a disinfection action to be taken in response 
to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified by a database of subscribers to 
an update service associated with said malware scanner, where said database includes said 
telephone number of said mobile data processing device to which said malware definition 
updating data is to be sent and a type of said mobile data processing device such that only 
malware definition i^dating data that is appropriate to said type of said mobile data processmg 
device is sent to said mobile data processing device. 

29. (Original) A metiiod as claimed m claim 28, wherem said mobile data processing device 
is a mobile telephone, 

30. (Original) A method as claimed in claim 28, wherein said mobile data processing device 
is a personal digital assistant having a connection to said wu«less public telephony network. 

31. (Cancelled) 

32. (Original) A method as clsdmed in claim 28, wherein said public wireless telephone 
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network is one of a CDMA network and a GSM network. 

33, (Original) A method as claimed in claim 28, wherein said data channel is also used for 
passing text messages. 

34, (Original) A method as claimed in claim 33, wherein said text messages are SMS 
messages. 

35, (Original) A method as claimed in claim 28, wherein traixsfer of said malware definition 
updating data is initiated from a source of said malware definition updating data, 

36, (Original) A method as claimed in claim 2, wherein said data channel is opeti whenever 
said mobile data processing device is switched on and connected to said public wireless 
telephony network. 

37, (Previously Presented) Apparatus for controlling a mobile data processing device to 
update malware definition data for a malv^e scanner of said mobile data processing device, said 
apparatus comprising: 

(i) link establishing logic operable to establish a wireless telephony linic between said 
mobile data processing device and a public wireless telephony network; 

(ii) update receiving logic operable to receive malware defmition updating data at said 
mobile data processing device via a data channel of said wireless telephony link; and 

(iii) malware definition updating logic operable to Update malware definition data stored 
upon said mobile data processing device using said malware definition updating data; 

wherein said mobile data processing device registers with a base station of said wireless 
telephony network when said link is established such that said base station and said wireless 
telephony network are notified of a telephone number of said mobile data processmg device for 
use in sending said malvrarc definition updating data to said mobile data processmg device; 

wherein when received data is received at said mobile data processing device, a type of 
said received data is identified to determine if said received data is said malware definition 
updating data, such that if said received data is said malware defmition updating data, a digital 
signature associated with said malware definition updating data is verified; 
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wherein if said digital signature is not verified, said malware definition updating data is 
ignored; 

wherein if said digital signature is verified, said malware definition updating data is 
utilized to update said malware definition data stored upon said mobile data processing device by 
appenditig said malware definition updating data to said malware definition data; 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated by one of automatically, semi-automatically, and 
manually upon an analysis of newly discovered malware and where said file includes a detection 
fingerprint, and at least one of a removal action and a disinfection action to be taken in response 
to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified by a database of subscribers to 
an update service associated with said malware scanner, where said database includes said 
telephone number of said mobile data processing device to which said malware definition 
updating data is to be sent and a type of said mobile data processing device such that only 
malware definition updating data that is appropriate to said type of said mobile data processing 
device is sent to said mobile data processing device. 

3S. (Original) Apparatus as claimed in claim 37, wherein said mobile data processing device 
is a mobile telephone. 

39. (Original) Apparatus as claimed in claim 37, wherein said mobile data processing device 
is a personal digital assistant having a connection to said wireless pubUc telephony network. 

40. (Cancelled) 

41 . (Original) Apparatus as claimed in claim 37, wherein said public wireless telephone 
network is one of a CDMA network and a GSM network. 

42. (Original) Apparatus as claimed in claim 37, wherein said data channel is also used for 
passing text messages. 

43. (Original) Apparatus as claimed in claim 42, wherein said text messages are SMS 
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messages, 

44. (Original) Apparatus as claimed in claim 37, wherein said step of transferring is initiated 
from a source of said malware definition updating data. 

45. (Original) Apparatus as claimed in claim 37, wherein said data channel is open whenever 
said mobile data processing device is switched on and connected to said public wireless 
telephony network. 

46. (Previously Presented) Apparatus for controlling a computer to initiate updating of 
malware definition data for a malware scanner of a mobile data processing device, said apparatus 
comprising; 

(i) link establishing logic operable to establish a wireless telephony link to said mobile 
data processing device via a public wireless telephony network; and 

(ii) update sending logic operable to send malware definition updating data to said mobile 
data processing device via a data channel of said wireless telephony link; 

wherein said mobile data processing device registers with a base station of said wireless 
telephony network when said link is established such that said base station and said wireless 
telephony network axe notified of a telephone number of said mobile data processing device for 
use in sending said malware definition updating data to said mobile data processing device; 

wherein when received data is received at said mobile data processing device, a type of 
said received data is identified to determine if said received data is said malware definition 
updating data, such that if said received data is said malware definition updating data, a digital 
signature associated with said malware definition updating data is verified; 

wherein if said digital signature is not verified, said malware definition updating data is 
ignored; 

wherein if said digital signature is verified, said malware definition updating data is 
utilized to update malware definition data stored upon said mobile data processing device by 
appending said malware definition updating data to said malware definition data; 

whei^in said malware definition updating data is provided in a malware definition 
updating file, where said file is generated by one of automatically, semi-automatically, and 
manually upon an analysis of newly discovered malware and where said file includes a detection 
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fingerprint, and at least one of a removal action and a. disinfection action to be taken in response 
to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified by a database of subscribers to an update 
service associated with said malware scanner, where said database includes said telephone number 
of said mobile data processing device to which said malware definition updating data is to be sent 
and a type of said mobile data processing device such that only malware definition updating data that 
is appropriate to said type of said mobile data processing device is sent to said mobile data 
processing device. 

47. (Original) Apparatus as claimed in claim 46, wherein said mobile data processing device is a 
mobile telephone. 

48. (Original) Apparatus as claimed in claim 46, wherein said mobile data processing device is a 
personal digital assistant having a connection to said wireless public telephony network. 

49. (Cancelled) 

50. (Original) ApparatU5 as claimed in claim 46, wherein said public wireless telephone network 
is one of a CDMA network and a GSM network. 

5 1 . (Original) Apparatus as claimed in claim 46, wherein said data channel is also used for 
passing text messages. 

52. (Original) Apparatus as claimed in claim 51, wherein said text messages are SMS messages. 

53 . (Original) Apparatus as claimed in claim 46, wherein transfer of malware defmition updating 
data is initiated fi:om a source of said malware definition updating data, 

54. (Original) Apparatus as claimed m claim 46, wherein said data channel is open whenever 
said mobile data processing device is switched on and connected to said public wireless telephony 
network. 
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DC EVIDENCE APPENDIX (37 C.F.R. § 41.37(c)(l)(ix)) Qrr <, „ 

There is no such eyidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.R. § 4137(c)(l)(x)) ^n-r ^ ^ 

There is no such related proceeding. 
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In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the vmdersigned at (408) 971-2573. For payment of any additional fees due 
in connection with the filing of this paper, the Commissioner is au&orized to charge such fees to 
Deposit Account No. 50-1351 (Order No. NAI1P449/01. 143.01). 



Respectfully sul 



By:. 




Kevin J, Zilka 
Reg. No. 41.429 

Zilka-Kotab, P.C. 
P.O. Box 721120 
San Jose, Califorgfa 95172-1 120 
Telephone: (408) 971-2573 
Facsimile: (408)971-4660 



Date: 
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